[liblzma] port uses compromised version #37839

marekr · 2024-03-29T18:36:37Z

Describe the bug
vcpkg updated liblzma to 5.6.0. This version is known as compromised and backdoored

https://nvd.nist.gov/vuln/detail/CVE-2024-3094
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

This is a solid 10.0 CVE score vulnerability

vcpkg should immediately revert from 5.6.0

Resolves #37839 Reverts #37199 See https://www.openwall.com/lists/oss-security/2024/03/29/4 Note that the version database is unmodified, only the baseline is changed. Because vcpkg builds liblzma from cmake sources downloaded from github and this backdoor required modifications only present in the release tarballs, it is our belief that vcpkg customers are not affected by this problem. However, we are reverting this version out of an abundance of caution as the threat actor clearly has broad access to liblzma infrastructure, and because we believe customers will start flagging this package by version as being a problem.

MichaelCurrie · 2024-03-30T10:53:54Z

This PR already addresses the issue by downgrading xz version, but it still leaves the build broken because the entire xz repo has been disabled by GitHub so ALL versions are blocked.

So, to fix your build, run git pull to sync that fix, and then make this unofficial one-liner change to grab xz from an unofficial mirror.

Then building will work again:

.\vcpkg install liblzma:x64-windows

carsten-grimm · 2024-03-30T12:48:18Z

This PR already addresses the issue by downgrading xz version, but it still leaves the build broken because the entire xz repo has been disabled by GitHub so ALL versions are blocked.

So, to fix your build, run git pull to sync that fix, and then make this unofficial one-liner change to grab xz from an unofficial mirror.

Then building will work again:
.\vcpkg install liblzma:x64-windows

If you are using vcpkg in manifest mode with a builtin baseline, you can use an overlay port to implement the suggestion by @MichaelCurrie .

dg0yt · 2024-03-30T13:15:21Z

to implement the suggestion by @MichaelCurrie

... until that fork is taken down for the same reasons as the official repo.

carsten-grimm · 2024-03-30T13:30:13Z

to implement the suggestion by @MichaelCurrie

... until that fork is taken down for the same reasons as the official repo.

Yes. I am sure the folks involved do not make these decisions lightly. I hope there will be an actual solution soon.

Neustradamus · 2024-03-30T14:20:30Z

The official XZ team announcement is here:

https://tukaani.org/xz-backdoor/

Important to know: There is no problem with contributors here like @carsten-grimm.

But several people mix all because I have requested the XZ update in vcpkg.
I have received a lot of bad messages (private and public).
I have no link with XZ project, I follow only the project and do announcement or/and update requests.
I have requested 5.4.5 and 5.6.0 because there was only 5.4.4 in vcpkg.

@gowthamgts has participated on Reddit against me badly and I have commented on two places where he has commented (on my SCRAM request publications):

You can look here the original comment:

https://news.ycombinator.com/item?id=39868682
All the XZ backdoor story on Reddit is here: https://news.ycombinator.com/item?id=39865810

You can follow my announcements here:

The good point, people speak about SCRAM "Salted Challenge Response Authentication Mechanism" security ;)

State of Play scram-sasl/info#1

Badly, some people or projects like only old unsecure mechanisms, some would like security improvements.

Make it easier to develop with SDL2 and Rust on Windows by getting a build environment setup. Previously attempted using 'cargo-vcpkg' but encountered build issues due to vcpkg relying on liblzma port that has been taken down due to being compromised: microsoft/vcpkg#37839

See microsoft/vcpkg#37839 and connected issues

Without this drawpile-srv does not include WebSockets support. Tested on Linux on Debian Bookworm x86 with bookworm-backports packages. Tested on Windows 11 23H2 build 22631.3374: * Temporarily required fox for xz repository unavailability: microsoft/vcpkg#37839 (comment) * Reported listening for WebSocket connections but inbound connections were closed without response rather than registered as a connection unless headers Sec-WebSocket-Version: 13 and Sec-WebSocket-Key: ... were provided; even after that it didn't connect - this was because my nginx server had root directives: # Don't pass request header and body to the server # prevents referer being a problem proxy_pass_request_headers off; proxy_pass_request_body off; # Don't pass the h2 upgrade header, as it breaks Safari proxy_hide_header Upgrade; Resolved by adding the following to the /drawpile-web/ws block: proxy_pass_header Upgrade; proxy_pass_request_headers on; proxy_pass_request_body on;

…oblems See microsoft/vcpkg#37839 and connected issues

See microsoft/vcpkg#37839

blessio · 2024-04-03T15:17:08Z

This PR already addresses the issue by downgrading xz version, but it still leaves the build broken because the entire xz repo has been disabled by GitHub so ALL versions are blocked.

So, to fix your build, run git pull to sync that fix, and then make this unofficial one-liner change to grab xz from an unofficial mirror.

Then building will work again:
.\vcpkg install liblzma:x64-windows

You may have to not only reinstall the library as explained in the above (THANKS! @MichaelCurrie). But also:

clean the vcpkg cache
How do I safely clean vcpkg archives and disable it? #14157 ( on windows this is to delete C:\Users\AppData\Local\vcpkg\archives - on other platforms please search the internet )
update the file portfile.cmake as explained above in all subfolders of VCPKG_ROOT\buildtrees\versioning_\versions\liblzma\

@MichaelCurrie

https://github.com/tukaani-project/xz has been disabled. Use bminor's fork of xz until the liblzma project publishes a new official repository as proposed by @MichaelCurrie in a comment on microsoft#37839

See microsoft/vcpkg#37839

@MichaelCurrie

https://github.com/tukaani-project/xz has been disabled. Use bminor's fork of xz until the liblzma project publishes a new official repository as proposed by @MichaelCurrie in a comment on microsoft#37839

@MichaelCurrie

https://github.com/tukaani-project/xz has been disabled. Use bminor's fork of xz until the liblzma project publishes a new official repository as proposed by @MichaelCurrie in a comment on microsoft#37839

@MichaelCurrie

https://github.com/tukaani-project/xz has been disabled. Use bminor's fork of xz until the liblzma project publishes a new official repository as proposed by @MichaelCurrie in a comment on microsoft#37839

For reference please look here microsoft/vcpkg#37839 TL;DR Github disabled downloading their artifacts thus resulting in 404

Because it's *still* busted in vcpkg. The workaround is from microsoft/vcpkg#37839. Relates to #1 and drawpile/Drawpile#1239.

See microsoft/vcpkg#37839

Neustradamus · 2024-05-31T21:51:58Z

@teo-tsirpanis has done a PR about the new XZ version (5.6.2) here:

[liblzma] Update to version 5.6.2. #39024

cc: @carsten-grimm.

Linked to:

Official XZ links:

BillyONeal mentioned this issue Mar 29, 2024

Revert [liblzma] update to version 5.6.0 (#37199) #37841

Merged

cbeuw mentioned this issue Mar 29, 2024

[liblzma] Build error on arm64-android #37608

Closed

WangWeiLin-MV added the category:port-bug The issue is with a library, which is something the port should already support label Mar 30, 2024

benine203 mentioned this issue Mar 30, 2024

[liblzma] error #37857

Closed

dg0yt mentioned this issue Mar 30, 2024

[liblzma] build failure #37591

Closed

BillyONeal closed this as completed in #37841 Mar 30, 2024

This was referenced Mar 31, 2024

[liblzma] Build error on arm64-linux #37872

Closed

[liblzma] Build error on x64-windows #37871

Closed

[liblzma] Build error on x86-windows #37870

Closed

OposDev mentioned this issue Mar 31, 2024

SEVERE vulnerability found in latest release (Spek 0.8.5) alexkay/spek#307

Closed

WangWeiLin-MV changed the title ~~liblzma port uses compromised version~~ [liblzma] port uses compromised version Apr 1, 2024

WangWeiLin-MV mentioned this issue Apr 1, 2024

[liblzma] build failure #37850

Closed

jonathanlinat mentioned this issue Apr 1, 2024

[Urgent security issue] [liblzma] port uses compromised version TrenchBroom/TrenchBroom#4538

Closed

LilyWangLL mentioned this issue Apr 1, 2024

[colmap] Build failure on x64-linux #37831

Closed

jorisvandenbossche mentioned this issue Apr 1, 2024

CVE-2024-3094 (aka "xz hackdoor") and GDAL and pyogrio's wheels geopandas/pyogrio#382

Closed

Osyotr mentioned this issue Apr 1, 2024

[liblzma] Unable to download "xz" caused install falied #37893

Closed

carlopi added a commit to duckdb/duckdb-test-staging that referenced this issue Apr 1, 2024

Temporarily skip iceberg builds due to xz / liblzma

5f7bb10

See microsoft/vcpkg#37839 and connected issues

AaronRM mentioned this issue Apr 1, 2024

[liblzma] Build error on arm64-android #37906

Closed

marekr mentioned this issue Apr 2, 2024

[liblzma] Build error on x64-windows #37911

Closed

fabsantandrea mentioned this issue Apr 2, 2024

Info: XZ library and vcpkg otland/forgottenserver#4639

Closed

GreenReaper mentioned this issue Apr 2, 2024

Add WebSockets build dependency to Linux, Windows drawpile/drawpile.github.io#1

Merged

carlopi added a commit to carlopi/duckdb that referenced this issue Apr 2, 2024

Temporarily skip arrow, aws and iceberg builds due to xz / liblzma pr…

aa57bdf

…oblems See microsoft/vcpkg#37839 and connected issues

DragonJoker added a commit to DragonJoker/Castor3D that referenced this issue Apr 3, 2024

vcpkg: Replaced lzma port.

79ca2bf

See microsoft/vcpkg#37839

SchaichAlonso mentioned this issue Apr 3, 2024

[liblzma] Workaround source repo having been disabled #37957

Closed

7 tasks

Silverlan added a commit to Silverlan/pragma that referenced this issue Apr 3, 2024

build: hotfix for vcpkg build error due to dead xz repository URL

a9140ae

See microsoft/vcpkg#37839

iguessthislldo mentioned this issue Apr 3, 2024

Update vcpkg to fix a failed download OpenDDS/OpenDDS#4557

Closed

Neustradamus mentioned this issue Apr 3, 2024

Is Avahi abandoned? New maintainer? avahi/avahi#388

Closed

GilanRanger mentioned this issue Apr 3, 2024

Broken build GabeRundlett/gvox_engine#13

Closed

mikeedwards mentioned this issue Apr 4, 2024

vcpkg install encounters dependency error on liblzma colmap/colmap#2493

Open

bansan85 mentioned this issue Apr 4, 2024

[liblzma] Build error on x64-windows #37970

Closed

chrismile mentioned this issue Apr 5, 2024

[libarchive] Build failure on x64-linux (static only) #37987

Closed

wonder-sk mentioned this issue Apr 5, 2024

Add libpq to overlays (to fix postgres crash upon project load) MerginMaps/mobile-sdk#109

Merged

bansan85 mentioned this issue Apr 5, 2024

[liblzma]:Invalid URL #37992

Closed

Baklap4 added a commit to performous/performous that referenced this issue Apr 6, 2024

Updated VCPKG commit to reflect latest xz changes

7e545cd

For reference please look here microsoft/vcpkg#37839 TL;DR Github disabled downloading their artifacts thus resulting in 404

Baklap4 mentioned this issue Apr 6, 2024

Updated VCPKG commit to latest performous/performous#981

Merged

1 task

sarlinpe mentioned this issue Apr 7, 2024

Fix missing public link deps, break circular feature-scene dependency colmap/colmap#2497

Merged

askmeaboutlo0m mentioned this issue Apr 8, 2024

Build error on Windows drawpile/Drawpile#1239

Closed

askmeaboutlo0m added a commit to drawpile/drawpile.github.io that referenced this issue Apr 8, 2024

Note xz workaround in Windows build instructions

86b928d

Because it's *still* busted in vcpkg. The workaround is from microsoft/vcpkg#37839. Relates to #1 and drawpile/Drawpile#1239.

This was referenced Apr 9, 2024

GH-39848: [Python][Packaging] Build pyarrow wheels with numpy RC instead of nightly apache/arrow#41097

Merged

[Python][Packaging] PyArrow wheel building is failing because of disabled vcpkg install of liblzma apache/arrow#41100

Closed

SlawekNowy pushed a commit to SlawekNowy/pragma that referenced this issue Apr 9, 2024

build: hotfix for vcpkg build error due to dead xz repository URL

c938fb1

See microsoft/vcpkg#37839

connorjak mentioned this issue Apr 9, 2024

[liblzma] Build error on x64-windows #38082

Closed

Neustradamus mentioned this issue May 31, 2024

[liblzma] Update to version 5.6.2. #39024

Merged

7 tasks

This was referenced May 31, 2024

[liblzma] update to version 5.6.0 #37199

Merged

[liblzma] update to 5.6.0 #37197

Closed

[liblzma] update to version 5.4.4 #34306

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[liblzma] port uses compromised version #37839

[liblzma] port uses compromised version #37839

marekr commented Mar 29, 2024

MichaelCurrie commented Mar 30, 2024 •

edited

Loading

carsten-grimm commented Mar 30, 2024 •

edited

Loading

dg0yt commented Mar 30, 2024

carsten-grimm commented Mar 30, 2024

Neustradamus commented Mar 30, 2024 •

edited

Loading

blessio commented Apr 3, 2024 •

edited

Loading

Neustradamus commented May 31, 2024

[liblzma] port uses compromised version #37839

[liblzma] port uses compromised version #37839

Comments

marekr commented Mar 29, 2024

MichaelCurrie commented Mar 30, 2024 • edited Loading

carsten-grimm commented Mar 30, 2024 • edited Loading

dg0yt commented Mar 30, 2024

carsten-grimm commented Mar 30, 2024

Neustradamus commented Mar 30, 2024 • edited Loading

blessio commented Apr 3, 2024 • edited Loading

Neustradamus commented May 31, 2024

MichaelCurrie commented Mar 30, 2024 •

edited

Loading

carsten-grimm commented Mar 30, 2024 •

edited

Loading

Neustradamus commented Mar 30, 2024 •

edited

Loading

blessio commented Apr 3, 2024 •

edited

Loading